feat(spm): never auto-scaffold; surface missing manifests at sync AND resolution

A missing community-library Package.swift is a real gap that must be fixed
deliberately (scaffold + patch-package, or upstream), not papered over. Two
changes make it loud and actionable, and remove the auto-scaffold that hid it.

1. init/update no longer auto-scaffold. `runScaffold` now runs ONLY for the
   explicit `spm scaffold` action; init/update/sync fall straight through to the
   autolinker, which throws MissingManifestError (exit 2 → hard Xcode build
   error) for any npm dep lacking a shipped/scaffolded manifest. Removed the
   interactive prompt, the --yes/non-TTY auto-accept, and the dry-run/skip
   machinery (confirmScaffold deleted). The post-scaffold guidance now points to
   patch-package only — the `"postinstall": "spm scaffold"` suggestion is gone,
   because auto-restoring on every install would defeat the pressure to fix the
   gap (a wiped scaffold SHOULD re-surface the error). reportMissingManifests
   now prints a 4-point message (scaffold → patch-package → tell the maintainer
   → returns on a fresh node_modules).

2. Eval-time missing-manifest guard in the generated aggregator Package.swift.
   SwiftPM resolves the package graph BEFORE the Xcode "Sync SPM Autolinking"
   build phase runs, so a scaffolded library manifest wiped by a node_modules
   reset (no committed patch) failed resolution with an opaque "package manifest
   cannot be accessed" — the sync-phase message never printed. Manifest eval may
   READ the filesystem (only writes are sandboxed), so the aggregator now checks
   each referenced library's Package.swift at resolution time and fatalErrors
   with the same actionable guidance. The sync generator re-emits the guard every
   build, so it is always present for the next resolution. npmName threaded onto
   NpmDepRef so the guard names the installed package, not its Swift target.

Verified E2E (/tmp/SpmE2E, remote mode): a wiped library manifest now surfaces
the 4-point message at resolution instead of the opaque error; the explicit
`spm scaffold` still scaffolds; init hard-errors (exit 2) without scaffolding.
323 spm/scripts tests pass; flow/prettier/eslint clean on touched files.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: chrfalch

packages/react-native/scripts/setup-apple-spm.js

@@ -802,25 +802,6 @@ async function maybePatchPodfile(
   );
 }
 
-function confirmScaffold(
-  depNames /*: Array<string> */,
-) /*: Promise<boolean> */ {
-  log('');
-  log(`Found ${depNames.length} community RN package(s) without SPM support:`);
-  for (const n of depNames) {
-    log(`  • ${n}`);
-  }
-  log('');
-  log(
-    'Scaffolding writes a Package.swift into node_modules/<dep>/ derived from\n' +
-      "the dep's podspec. node_modules gets wiped by `npm install` — to persist:\n" +
-      '  • add a `"postinstall": "npx react-native spm scaffold"` to package.json, OR\n' +
-      '  • `npx patch-package <dep>` after scaffolding.',
-  );
-  log('');
-  return promptYesNo('Generate Package.swift for the deps above?', true);
-}
-
 function confirmDestructive(
   targets /*: Array<CleanTarget> */,
 ) /*: Promise<boolean> */ {
@@ -978,15 +959,18 @@ function runCodegenStep(
  * Runs as part of `init` / `update` / `scaffold` actions. Each invocation
  * is a no-op for deps already in a clean state.
  */
+// Scaffolding is an EXPLICIT, manual step (`npx react-native spm scaffold`) and
+// is NEVER run automatically by init/update/sync. A missing Package.swift is a
+// real gap that must surface as a hard build error (see reportMissingManifests)
+// so the user fixes it deliberately: scaffold, then persist with patch-package
+// (node_modules is not committed), and ideally get it fixed upstream. There is
+// intentionally no prompt and no auto-restore — auto-scaffolding would hide the
+// error, and a wiped scaffold SHOULD re-surface it.
 async function runScaffold(
   args /*: SetupArgs */,
   appRoot /*: string */,
   projectRoot /*: string */,
   reactNativeRoot /*: string */,
-  // Caller's resolved action — same union as resolveAction's return type.
-  // Typed precisely so Flow accepts the `action === 'scaffold'` checks
-  // below (strict mode rejects `string === <singleton>` as invalid-compare).
-  action /*: 'init' | 'update' | 'sync' | 'clean' | 'codegen' | 'download' | 'scaffold' */,
 ) /*: Promise<void> */ {
   // Resolve the cache slot identifier so the scaffolded files carry it as
   // a comment — that's how SPM's manifest hash bumps on slot transitions.
@@ -1000,74 +984,20 @@ async function runScaffold(
     // doesn't get the slot-bump comment.
   }
 
-  // Pass 1: dry-run to discover which deps would be scaffolded for the
-  // FIRST time (no existing Package.swift). Those are the only ones we
-  // prompt the user about — regens of files we already own happen silently.
-  let dryResults;
-  try {
-    dryResults = scaffoldAll({
-      appRoot,
-      projectRoot,
-      reactNativeRoot,
-      cacheSlotLabel,
-      force: action === 'scaffold',
-      dryRun: true,
-    });
-  } catch (e) {
-    logError(
-      `scaffold dry-run failed: ${e.message}. Continuing — community deps may not autolink.`,
-    );
-    return;
-  }
-
-  const newScaffoldDeps /*: Array<string> */ = [];
-  for (const r of dryResults) {
-    if (r.status === 'written' && r.previouslyExisted === false) {
-      newScaffoldDeps.push(r.depName);
-    }
-  }
-
-  // Decide which (if any) first-time deps the user wants scaffolded.
-  // - `scaffold` action: user explicitly asked → no prompt
-  // - `--yes`: bypass prompt
-  // - non-TTY (CI): auto-accept
-  // - otherwise: prompt with a list; default Yes
-  let skipDeps /*: Array<string> */ = [];
-  if (
-    newScaffoldDeps.length > 0 &&
-    action !== 'scaffold' &&
-    !args.cleanYes &&
-    process.stdin.isTTY === true
-  ) {
-    const proceed = await confirmScaffold(newScaffoldDeps);
-    if (!proceed) {
-      // Decline ALL first-time scaffolds; existing scaffolder-marker files
-      // still get regenerated (slot changes etc.).
-      skipDeps = newScaffoldDeps;
-      log(
-        'Skipping first-time scaffolds for this run. ' +
-          'Re-run `npx react-native spm scaffold` (or pass --yes) to accept.',
-      );
-    }
-  }
-
   let results;
   try {
     results = scaffoldAll({
       appRoot,
       projectRoot,
       reactNativeRoot,
       cacheSlotLabel,
-      // `scaffold` action forces a re-render even when slot is unchanged,
-      // so a user re-running it after editing a podspec gets the new
-      // content. `update`/`init` are non-forcing (idempotent).
-      force: action === 'scaffold',
-      skipDeps,
+      // Always force a re-render so re-running after editing a podspec picks
+      // up the new content.
+      force: true,
     });
   } catch (e) {
-    logError(
-      `scaffold failed: ${e.message}. Continuing — community deps may not autolink.`,
-    );
+    logError(`scaffold failed: ${e.message}.`);
+    process.exitCode = 1;
     return;
   }
 
@@ -1084,9 +1014,11 @@ async function runScaffold(
     }
     log('');
     log(
-      'TIP: node_modules is wiped by `npm install`. To persist:\n' +
-        '  • add `"postinstall": "npx react-native spm scaffold"` to package.json (preferred), OR\n' +
-        '  • `npx patch-package <dep>` after scaffolding (cross-machine portability with caveats).',
+      'node_modules is NOT committed and is wiped by `npm install`. To keep\n' +
+        'these manifests, create and commit a patch with a tool like patch-package:\n' +
+        '  • `npx patch-package <dep>` for each scaffolded dep, then commit the patch.\n' +
+        'Also consider asking the maintainer to ship a Package.swift upstream.\n' +
+        'Without a committed patch the build will hard-error again after a fresh install.',
     );
     log('');
   }
@@ -1681,12 +1613,14 @@ async function main(argv /*:: ?: Array<string> */) /*: Promise<void> */ {
   }
 
   // Scaffold Package.swift for community RN packages that don't ship SPM
-  // support. Runs BEFORE the autolinker so the autolinker sees the
-  // scaffolded files as self-managed (via isSelfManagedPackage's
-  // AUTOGEN_MARKER check) and references them directly from the aggregator.
-  // No-op for deps that already have an upstream Package.swift, opted out,
-  // or had no .podspec.
-  await runScaffold(args, appRoot, projectRoot, reactNativeRoot, action);
+  // support — ONLY for the explicit `scaffold` action. init/update never
+  // auto-scaffold: a missing manifest must surface as a hard error (the
+  // autolinker below throws MissingManifestError → exit 2) so the gap is
+  // visible and fixed deliberately (scaffold + patch-package, or upstream).
+  // Auto-scaffolding would silently hide that real error.
+  if (action === 'scaffold') {
+    await runScaffold(args, appRoot, projectRoot, reactNativeRoot);
+  }
 
   runCodegenStep(projectRoot, appRoot, reactNativeRoot, args.skipCodegen);
   log('Generating build/generated/autolinking/Package.swift...');

packages/react-native/scripts/spm/__tests__/generate-spm-autolinking-test.js

@@ -57,6 +57,36 @@ describe('generateAutolinkedPackageSwift (aggregator)', () => {
     expect(result).toContain('.product(name: "B", package: "B")');
   });
 
+  it('emits an eval-time missing-manifest guard naming each lib by npm name', () => {
+    const result = generateAutolinkedPackageSwift({
+      npmDeps: [
+        {
+          swiftName: 'ReactNativeSafeAreaContext',
+          packagePath: 'libs/ReactNativeSafeAreaContext',
+          npmName: 'react-native-safe-area-context',
+        },
+      ],
+    });
+    // The guard runs at resolution (manifest eval) — before the Xcode sync
+    // build phase — so a wiped library manifest surfaces an actionable message
+    // instead of SwiftPM's opaque "manifest cannot be accessed".
+    expect(result).toContain('let __rnAutolinkedLibs');
+    expect(result).toContain(
+      '(path: "libs/ReactNativeSafeAreaContext", npm: "react-native-safe-area-context")',
+    );
+    expect(result).toContain('FileManager.default.fileExists');
+    expect(result).toContain('npx react-native spm scaffold');
+    expect(result).toContain('npx patch-package');
+    expect(result).toContain('fatalError(');
+    // The guard reads its own location to resolve lib paths.
+    expect(result).toContain('#filePath');
+  });
+
+  it('omits the guard entirely when there are no npm deps', () => {
+    const result = generateAutolinkedPackageSwift({});
+    expect(result).not.toContain('__rnAutolinkedLibs');
+  });
+
   it('emits inline .target() blocks for each inlineTarget alongside AutolinkedAggregate', () => {
     const result = generateAutolinkedPackageSwift({
       inlineTargets: [
@@ -823,10 +853,14 @@ describe('MissingManifestError + reportMissingManifests', () => {
     expect(err).toBeInstanceOf(MissingManifestError);
     expect(errSpy).toHaveBeenCalledTimes(2);
     const lines = errSpy.mock.calls.map(c => c[0]);
-    // Xcode only renders lines beginning with `error: `.
+    // Xcode only renders the `error: ` headline; each dep is one such message.
     expect(lines.every(l => l.startsWith('error: '))).toBe(true);
     expect(lines[0]).toContain('react-native-foo');
     expect(lines[0]).toContain('npx react-native spm scaffold');
+    // The pressure mechanics: persist via patch-package, and the error returns
+    // on a fresh node_modules if you don't (no auto-scaffold/auto-restore).
+    expect(lines[0]).toContain('patch-package');
+    expect(lines[0]).toContain('node_modules is reset');
   });
 
   it('tells the user a podspec-less dep cannot be auto-scaffolded', () => {

packages/react-native/scripts/spm/generate-spm-autolinking.js

@@ -339,13 +339,20 @@ function reportMissingManifests(
   deps /*: Array<{name: string, npmName: string, hasPodspec: boolean}> */,
 ) /*: MissingManifestError */ {
   for (const d of deps) {
-    const fix = d.hasPodspec
-      ? `Run \`npx react-native spm scaffold\` from your terminal to generate one (persist it with patch-package, or contribute a Package.swift upstream to ${d.npmName}).`
-      : `${d.npmName} ships no podspec, so it cannot be auto-scaffolded — it needs Swift Package Manager support added manually.`;
-    // eslint-disable-next-line no-console
-    console.error(
-      `error: Package.swift is missing for library "${d.npmName}". ${fix}`,
-    );
+    if (d.hasPodspec) {
+      console.error(
+        `error: Package.swift is missing for library "${d.npmName}" — it ships no Swift Package Manager support.\n` +
+          `  1. Run \`npx react-native spm scaffold\` to generate a Package.swift for ${d.npmName}.\n` +
+          `  2. Persist it with a patch: \`npx patch-package ${d.npmName}\`, and commit the patch (node_modules is not committed).\n` +
+          `  3. Ask ${d.npmName}'s maintainer to ship a Package.swift upstream (or contribute one).\n` +
+          '  4. Without a committed patch, this same error returns whenever node_modules is reset (fresh install / CI).',
+      );
+    } else {
+      console.error(
+        `error: Package.swift is missing for library "${d.npmName}", and it ships no podspec so it cannot be scaffolded automatically.\n` +
+          `  • It needs Swift Package Manager support added manually — ask ${d.npmName}'s maintainer to ship a Package.swift upstream (or contribute one).`,
+      );
+    }
   }
   return new MissingManifestError(deps);
 }
@@ -771,6 +778,49 @@ function generateAutolinkedPackageSwift(
   const inlineDeclsBlock =
     inlineDecls.length > 0 ? `,\n${inlineDecls.join(',\n')}` : '';
 
+  // Eval-time missing-manifest guard. SwiftPM resolves the package graph BEFORE
+  // the Xcode "Sync SPM Autolinking" build phase runs, so a community library
+  // whose Package.swift is absent at resolution time (e.g. a scaffolded manifest
+  // wiped by a node_modules reset without a committed patch) fails resolution
+  // with an opaque "package manifest cannot be accessed" error — and the
+  // actionable sync-phase message never prints. Manifest evaluation may READ the
+  // filesystem (only writes are sandboxed), so the aggregator checks each
+  // referenced library here and explains the cause + fix at resolution time.
+  const guardEntries = npmDeps.map(d => {
+    const pkgPath = d.packagePath ?? `packages/${d.swiftName}`;
+    return `    (path: "${pkgPath}", npm: "${d.npmName ?? d.swiftName}")`;
+  });
+  const guardBlock =
+    guardEntries.length > 0
+      ? `// Eval-time guard: surface a wiped/absent library Package.swift here (at
+// resolution) instead of the opaque SwiftPM "manifest cannot be accessed".
+let __rnAutolinkedLibs: [(path: String, npm: String)] = [
+${guardEntries.join(',\n')},
+]
+do {
+    let __here = URL(fileURLWithPath: #filePath).deletingLastPathComponent()
+    let __missing = __rnAutolinkedLibs.filter {
+        !FileManager.default.fileExists(
+            atPath: __here.appendingPathComponent($0.path)
+                .appendingPathComponent("Package.swift").path)
+    }
+    if !__missing.isEmpty {
+        var __msg = ""
+        for lib in __missing {
+            __msg += "error: Package.swift is missing for library \\"\\(lib.npm)\\" — its Swift Package Manager manifest is not present (a scaffolded manifest wiped by a node_modules reset without a committed patch, or the library ships none).\\n"
+            __msg += "  1. Run \`npx react-native spm scaffold\` to (re)generate it.\\n"
+            __msg += "  2. Persist it with \`npx patch-package \\(lib.npm)\` and commit the patch (node_modules is not committed).\\n"
+            __msg += "  3. Ask \\(lib.npm)'s maintainer to ship a Package.swift upstream.\\n"
+            __msg += "  4. Without a committed patch, this error returns on every fresh install / CI.\\n"
+        }
+        FileHandle.standardError.write(Data(__msg.utf8))
+        fatalError("Missing Package.swift for: \\(__missing.map { $0.npm }.joined(separator: ", ")). See the message above.")
+    }
+}
+
+`
+      : '';
+
   return `// swift-tools-version: 6.0
 // AUTO-GENERATED by scripts/generate-spm-autolinking.js – do not edit manually.
 // Top-level Autolinked package. Every autolinked dep (npm or spmModule) is
@@ -781,7 +831,7 @@ function generateAutolinkedPackageSwift(
 import PackageDescription
 import Foundation
 
-let package = Package(
+${guardBlock}let package = Package(
     name: "Autolinked",
     platforms: [.iOS(.v15)],
     products: [
@@ -1243,6 +1293,7 @@ function main(argv /*:: ?: Array<string> */) /*: void */ {
       aggregatorPackageDeps.push({
         swiftName: target.name,
         packagePath: `libs/${target.name}`,
+        npmName: entry.npmName ?? target.name,
       });
       continue;
     }

packages/react-native/scripts/spm/spm-types.js

@@ -241,6 +241,10 @@ export type NpmDepRef = {
   // Path passed to .package(path:). Relative to autolinked/ (the aggregator's
   // dir). For in-place synth this is the dep's real source dir.
   packagePath?: string,
+  // The npm package name (e.g. react-native-safe-area-context). Used by the
+  // aggregator's eval-time missing-manifest guard to name the library a
+  // developer installed (not its Swift target name).
+  npmName?: string,
 };
 
 export type AggregatorInput = {